[Prodigal88]

Hello all. I need to get my ipconfig cmd to work. When I type ipconfig into the cmd prompt i get the error "'ipconfig' is not recognized as an internal or external command, operable program or batch file." I have checked and ipconfig.exe is in the system32 folder. It used to work before but just suddenly stopped working recently. I have also noticed that 'ping' and 'tracert' are not working either. Do you have any idea why this migth be happening? Thank you in advance for any help you have.

Danny

[Greazy]

OUCH!! I have not heard of that one yet. Sounds like a pretty nasty little dude... Are you sure that it's not just pointing the PATH to a different location? Try this, at the command prompt, type;
PATH
Post the results here please.

Greazy Mcgeezy

[Metallica]

Standardfix for the Backdoor.Win32.Rbot.pd aka P2P-Worm.Win32.Alcan.a

Please don't forget to check if the path for your system directory is correct.
Usually you will need to replace
C:\WINDOWS\system32\
with C:\WINNT\system32\ for Windows 2000
with C:\WINDOWS\system\ for windows 95, 98 and ME
with C:\WINXP\System32\ for some XP installs

*Click Here to download Killbox by Option^Explicit.
*Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program.
*In the killbox program, select the Delete on Reboot option.
*Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\Program Files\MsConfigs\MsConfigs.exe
C:\WINDOWS\system32\p2pnetwork.exe
C:\WINDOWS\system32\CMD.COM
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\ping.com
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\taskmgr.com
C:\WINDOWS\system32\tracert.com

*Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
*Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

After the reboot you will have to remove the startups for the worm, but youwill be able to use everything again.
When in doubt: http://www.geekstogo.com/forum/You_Must_Re..._Log-t2852.html

Regards,

[Prodigal88]

Alright, thanks for the help. Here is results of typing PATH.

PATH=%SYSTEMROOT%\SYSTEM32;%SYSTEMROOT%;%SYSTEMROOT%\SYSTEM32\WBEM;C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL;C:\DOCUMENTS AND SETTINGS\DAN\DESKTOP\KL\
WSG32\

Im not sure if this is the correct path. If it is then I will try to remove the worm, but I'm not sure if I have the worm because I can still connect to the internet. Does the worm block your internet connection too? By the way this is on my laptop connected wirelessly if that helps at all.

ps- and yes yezpahr, i very much appreciate your help along with everyone elses.

[back2killah]

I'm not sure about this, but the last entry in your $PATH seems to be a match for WSG32, which is a spyware known as GoldenKeyLog or something like that. Very odd for a subfolder on the desktop to be added to the PATH variable.

You may want to check the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key in your registry and post what you see.

It definitely looks like your computer's been infected.

Perhaps someone else can confirm my suspicion.

[Prodigal88]

ok, so i did the standard fix for Backdoor.Win32.Rbot.pd that metallica told me to do and that didnt work. As for back2killah's post, here is a screen shot of what i saw under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

[gerryf]

Prodigal, I suspect spyware---rather than attack this piecemeal, please go to the malware forum in my signature and follow the instructions at the top....Especially the CLICK HERE .

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty, then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.

[back2killah]

Hmm, that looks pretty clean.
Do me a favor and bring up a command prompt and type "echo %systemroot%" w/o the quotes.

When I do the PATH command, the %systemroot% variable is already replaced with C:\WINDOWS in its place, so it seems odd that your path shows %systemroot% still.

[Prodigal88]

back, it says C:\WINDOWS

[Prodigal88]

gerryf, on Jun 1 2005, 01:28 PM, said:

Prodigal, I suspect spyware---rather than attack this piecemeal, please go to the malware forum in my signature and follow the instructions at the top....Especially the CLICK HERE .

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty, then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.

Well, i did everything that page said to do, nothing turned up and the commands still dont work. I posted my hijack log and explained in the malware forum but nobody replied even after a couple of bumps

[gerryf]

darned weird one

in the environemnt section from above, what does it say under ComSpec and windir?

[Prodigal88]

environment section?

[gerryf]

sorry....I read too quickly...I see now how you got your path statement

Right click MY COMPUTER, choose PROPERTIES< choose ADVANCED, choose ENVIRONMENT VARIABLES

[Prodigal88]

ok, comspec says "C:\windows\system32\cmd.exe"
and windir says "C:\windows"